Add a programs.podman module #54925

vdemeester · 2019-01-30T10:22:09Z

Motivation for this change

podman requires some configuration files, and system package available. This allows to do that by just using programs.podman.enable = true in a nixos configuration.
(it's a port of my own module)

/cc @nlewo @Mic92

Things done

`podman` requires some configuration files, and system package available. This allows to do that by just using `programs.podman.enable = true` in a nixos configuration. Signed-off-by: Vincent Demeester <vincent@sbr.pm>

nlewo · 2019-02-05T10:11:19Z

@vdemeester is it supposed to be used with a non root user?
Because with my user, it fails with

podman run alpine
error creating libpod runtime: could not find a working binary (configured options: [/usr/bin/runc /usr/sbin/runc /usr/local/bin/runc /usr/local/sbin/runc /sbin/runc /bin/runc /usr/lib/cri-o-runc/sbin/runc]): invalid argument

while it downloads the alpine image if I run it with the root account.

It would also be nice to add a really simple test that could be used to easily check this module is working. Something similar to https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/yabar.nix.

vdemeester · 2019-02-05T10:17:04Z

@nlewo right it won't work for a non root user, this is the "main" problem I've got so far. When running as a user podman doesn't seem to read /etc/containers/* files (this is why I have a module for my user too).

I'll look into tests 😉

nlewo · 2019-02-05T10:35:00Z

Works as expected with a root account.

nlewo

Even if we don't have a test, I think we could merge it :) Mainly because it would make podman easily usable in NixOS.

nlewo · 2019-02-10T19:13:14Z

nixos/modules/programs/podman.nix

+    environment.etc."containers/policy.json".text = ''
+    {
+      "default": [
+        { "type": "insecureAcceptAnything" }


I don't think we use this insecure kind of value by default. Could you remove it?

Also, what about using builtins.toJSON to make the file typo-free, as syntax would at least be checked at compile time.

nlewo · 2019-02-10T19:15:09Z

nixos/modules/programs/podman.nix

+
+    environment.etc."containers/registries.conf".text = ''
+      [registries.search]
+      registries = ['docker.io', 'registry.fedoraproject.org', 'quay.io', 'registry.access.redhat.com', 'registry.centos.org']


I don't think users need all of these registries by default. Maybe docker.io would be sufficient.

Just to add, this should be a config option.

benley · 2019-04-15T18:11:11Z

Once this is ready, it would be great to use podman as a backend for the docker-containers module for nicer systemd integration

bachp

Running as root works without issue.

Rootless mode seems to have additional issues with version 1.2.0 then the ones already described.

I get the following two errors when trying to pull an image:

cannot find mappings for user pascal: No subuid ranges found for user "pascal" in /etc/subuid
and
using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding subids

But I think we can look into rootles mode in a separate PR.

infinisil · 2019-05-15T23:01:56Z

Um, so this is a pretty much fully hard-coded configuration? Relevant for NixOS/rfcs#42

vdemeester · 2019-05-16T07:34:37Z

@infinisil yeah 😓 I need to update this to add more options and the possibility to bring you own configuration 👼

bachp · 2019-06-22T11:24:22Z

nixos/modules/programs/podman.nix

+}
+    '';
+
+    environment.systemPackages = with pkgs; [ cfg.package cfg.conmonPackage cfg.runcPackage ];


I also added slirp4netns here, other wise I get the following error when running prodman run in rootless mode:

ERRO[0000] could not find slirp4netns, the network namespace won't be configured: exec: "slirp4netns": executable file not found in $PATH

CNI would be needed here too, or how does it work in conjunction with the configured CNI package?

To be honest I'm currently only running a container with host network. So I probably haven't really used most the CNI stuff.

bachp · 2019-06-22T11:26:35Z

I think I got rootless to work on my system. The two things I needed to do was:

Add subuids and subgids to my user via:

subUidRanges = [{ startUid = 100000; count = 65536; }];
subGidRanges = [{ startGid = 100000; count = 65536; }];

Install slirp4netns

saschagrunert

I really like that. I think it might be necessary to add a wrapper for containers/storage and containers/image based configurations, which then can be used by podman, buildah, slopes and CRI-O. WDYT?

saschagrunert · 2019-08-18T20:29:06Z

nixos/modules/programs/podman.nix

+}
+    '';
+
+    environment.systemPackages = with pkgs; [ cfg.package cfg.conmonPackage cfg.runcPackage ];


CNI would be needed here too, or how does it work in conjunction with the configured CNI package?

saschagrunert · 2019-08-18T20:29:41Z

nixos/modules/programs/podman.nix

+
+    environment.etc."containers/libpod.conf".text = ''
+      image_default_transport = "docker://"
+      runtime_path = ["${cfg.runcPackage}/bin/runc"]


This can be now inferred from $PATH

saschagrunert · 2019-08-18T20:29:53Z

nixos/modules/programs/podman.nix

+    environment.etc."containers/libpod.conf".text = ''
+      image_default_transport = "docker://"
+      runtime_path = ["${cfg.runcPackage}/bin/runc"]
+      conmon_path = ["${cfg.conmonPackage}/bin/conmon"]


This too. :)

siers · 2019-11-28T11:37:20Z

These configs let me run podman currently, so even without serious changes to the PR, I think this is useful already.

Br1ght0ne · 2019-11-28T13:09:37Z

nixos/modules/programs/podman.nix

+          Whether to configure podman
+        '';
+        type = types.bool;
+      };


Can mkEnableOption be used?

-enable = mkOption { - default = false; - description = '' - Whether to configure podman - ''; - type = types.bool; -}; +enable = mkEnableOption "podman";

adisbladis · 2019-11-28T14:04:33Z

nixos/modules/programs/podman.nix

+        description = "podman package to be used";
+        type = types.package;
+      };
+      runcPackage = mkOption {


Imho it's better to wrap the podman binary in the derivation to add these dependencies, podman is also useful on non-nixos.

adisbladis · 2019-11-28T14:04:54Z

nixos/modules/programs/podman.nix

+        description = "runc package to be used";
+        type = types.package;
+      };
+      conmonPackage = mkOption {


Same, in fact same for all packages. It's better to wrap them.

adisbladis · 2019-11-28T14:05:25Z

nixos/modules/programs/podman.nix

+
+    environment.etc."containers/registries.conf".text = ''
+      [registries.search]
+      registries = ['docker.io', 'registry.fedoraproject.org', 'quay.io', 'registry.access.redhat.com', 'registry.centos.org']


Just to add, this should be a config option.

vdemeester · 2020-04-20T10:04:45Z

Closing in favor of #85604 👼

Add a programs.podman module

510c66a

`podman` requires some configuration files, and system package available. This allows to do that by just using `programs.podman.enable = true` in a nixos configuration. Signed-off-by: Vincent Demeester <vincent@sbr.pm>

vdemeester requested a review from infinisil as a code owner January 30, 2019 10:22

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 labels Jan 30, 2019

nlewo requested changes Feb 10, 2019

View reviewed changes

bachp approved these changes May 4, 2019

View reviewed changes

bachp reviewed Jun 22, 2019

View reviewed changes

saschagrunert reviewed Aug 18, 2019

View reviewed changes

saschagrunert mentioned this pull request Aug 18, 2019

podman doesn't work well #65202

Closed

gebner mentioned this pull request Sep 11, 2019

nixos/podman: support configuring registries and policy [WIP] #68343

Closed

10 tasks

Br1ght0ne reviewed Nov 28, 2019

View reviewed changes

adisbladis requested changes Nov 28, 2019

View reviewed changes

adisbladis mentioned this pull request Apr 20, 2020

nixos/virtualisation.podman: Init module #85604

Merged

10 tasks

vdemeester closed this Apr 20, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a programs.podman module #54925

Add a programs.podman module #54925

vdemeester commented Jan 30, 2019 •

edited

nlewo commented Feb 5, 2019

vdemeester commented Feb 5, 2019

nlewo commented Feb 5, 2019

nlewo left a comment

nlewo Feb 10, 2019

MartinPotier Dec 11, 2019 •

edited

nlewo Feb 10, 2019

adisbladis Nov 28, 2019

benley commented Apr 15, 2019

bachp left a comment

infinisil commented May 15, 2019

vdemeester commented May 16, 2019

bachp Jun 22, 2019

saschagrunert Aug 18, 2019 •

edited

bachp Aug 19, 2019

bachp commented Jun 22, 2019

saschagrunert left a comment

saschagrunert Aug 18, 2019 •

edited

saschagrunert Aug 18, 2019

saschagrunert Aug 18, 2019

siers commented Nov 28, 2019

Br1ght0ne Nov 28, 2019

adisbladis Nov 28, 2019

adisbladis Nov 28, 2019

adisbladis Nov 28, 2019

vdemeester commented Apr 20, 2020

Add a programs.podman module #54925

Add a programs.podman module #54925

Conversation

vdemeester commented Jan 30, 2019 • edited

Motivation for this change

Things done

nlewo commented Feb 5, 2019

vdemeester commented Feb 5, 2019

nlewo commented Feb 5, 2019

nlewo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MartinPotier Dec 11, 2019 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

benley commented Apr 15, 2019

bachp left a comment

Choose a reason for hiding this comment

infinisil commented May 15, 2019

vdemeester commented May 16, 2019

Choose a reason for hiding this comment

saschagrunert Aug 18, 2019 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bachp commented Jun 22, 2019

saschagrunert left a comment

Choose a reason for hiding this comment

saschagrunert Aug 18, 2019 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

siers commented Nov 28, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vdemeester commented Apr 20, 2020

vdemeester commented Jan 30, 2019 •

edited

MartinPotier Dec 11, 2019 •

edited

saschagrunert Aug 18, 2019 •

edited

saschagrunert Aug 18, 2019 •

edited